Slashdot Log In
Diebold Disks May Have Been For Testers
Posted by
Zonk
on Sun Oct 22, 2006 10:28 PM
from the concientious-tester dept.
from the concientious-tester dept.
opencity writes "The Washington Post reports on the two Diebold source disks that were anonymously sent to a Maryland election official this past week. Further investigation has lead individuals involved to believe the disks came from a security check demanded by the Maryland legislature sometime in 2003." From the article: "Critics of electronic voting said the most recent incident in Maryland casts doubt on Lamone's claim that Maryland has the nation's most secure voting system. "There now may be numerous copies of the Diebold software floating around in unauthorized hands," said Linda Schade, co-founder of TrueVoteMD, which has pressed for a system that provides a verifiable paper record of each vote."
Related Stories
[+]
IT: Opening Diebold Source, the Hard Way 299 comments
Doc Ruby writes to tell us about an article in the Baltimore (MD) Sun, reporting that someone sent a package to a former legislator containing what appears to be Diebold source code. From the article:
"Diebold Election Systems Inc. expressed alarm and state election officials contacted the FBI yesterday after a former legislator received an anonymous package containing what appears to be the computer code that ran Maryland's polls in 2004... The availability of the code — the written instructions that tell the machines what to do — is important because some computer scientists worry that the machines are vulnerable to malicious and virtually undetectable vote-switching software. An examination of the instructions would enable technology experts to identify flaws, but Diebold says the code is proprietary and does not allow public scrutiny of it." Read on for more of Doc Ruby's comments and questions.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Can't do much with these disks (Score:5, Funny)
Re:Can't do much with these disks (Score:5, Funny)
It's still great fun over the LAN!!
Getting a bunch of friends together to suborn the vote is always a good time
Parent
Re:Can't do much with these disks (Score:5, Insightful)
And, frankly, the AI is horribly unrealistic. All the little guys that you tell to cast votes... Most of them just ignore you. It's like they don't even notice you, or anything going on. And, the guys being voted for are like crazy over the top cartoon villains. Whoever made this game is obviously a moron, and has no understanding of a decent plot.
Actually, on a more serious note... I haven't been able to find a torrent. This shit is pretty fucking fundamental to our democracy, and when it finally gets 'leaked,' it manages to stay buttoned up? Seriously, do we know anything about the source? Does anybody have a torrent, or at least asn assessment from somebody qualified to be frightened by looking at it? As far as I'm concerned, every citizen of the US not only should have the right to see the mechanics of demacracy, but an obligation to do so. Anybody who doesn't try to get ahold of the source code running their local voting machines should be considered grossly negligent.
Parent
If the attackers can use the source to attack it (Score:5, Insightful)
Having numerous copies floating around is a good thing if disclosure of security holes is encouraged, and the fact that Diabold are implying that the security of their systems rely on people not having access to the source code is a very bad thing.
Lets look at things logically. The only people who would rig the election using those machines would have to have physical access to the machines, and if they did they wouldn't need the source code to highlight security holes. If the source code was released then the people who would be advantaged would be the people who would responsibly disclose security holes.
Re:If the attackers can use the source to attack i (Score:5, Interesting)
The real lesson here is the lengths some politicians will go to so that they appear "right".
(OK, and Diebold also has security issues - but that is a side issue, everyone has security issues. These are the guys making ATMs, for goodness sake. A voting machine that is as secure as an ATM is probably good enough. You can't stop human fraud via a machine - humans win every time.)
Parent
Re:If the attackers can use the source to attack i (Score:5, Insightful)
Wasn't it just a few weeks ago people were finding the passwords for ATMs 'hidden' right there on the net with instructions on how to reprogram them from the front pannel so that it thought the 20s slot was actually dispensing $5s???
If this is the security we can expect...well, I just hope my side finds the password list before the other side. Those bastards are slimy cut and run warmongers who want to stay the course of flipflopping.
Parent
Re:If the attackers can use the source to attack i (Score:5, Insightful)
If the system were as secure as an ATM network I would have to agree. An ATM gives you a bit of paper to prove the transaction took place and are fully auditable by the bank, the voting machines in question do not give a receipt and do not leave an audit trail. The fact that diebold also makes ATM's indicates nothing less than malice in the design of such a piss poor security scheme for their voting machines.
Parent
Re:If the attackers can use the source to attack i (Score:5, Insightful)
Parent
Re:If the attackers can use the source to attack i (Score:5, Insightful)
That's not what we're getting, as the research and disclosures have made painfully clear.
In any case, Diebold has had some trouble with ATMs, including the ATM reprogrammed as a jukebox [thetartan.org] and the ATMs infected by a virus [windowsfordevices.com].
Voting machines are a harder and more safety-critical application than ATMs. Voting machines have to preseve anonymity. Imagine how that would complicate banking. Then, the worst case failure of an ATM is that some money changes hands inappropriately and laywers earn lots of money sorting it out. The worst case failure of a voting system is an election lost to fraud, meaning the victors are the crooks. The damage is potentially incalculable: think of the nations ruined by having the wrong leaders.
Parent
Stupid (Score:5, Insightful)
Instead, I bet it's a pile of shit. Recycled code, buffer vulnerabilities, piles of ad hoc crap, with poor documentation.
I hope someone does find a way to exploit the code. People need to wake the hell up.
What's the problem again? (Score:5, Insightful)
If I didn't misunderstand, someone in D.C. should give this lady a call and explain to her the pitfalls of "security through obscurity" and why openness is a Good Thing.
Conspiracy theory (Score:5, Funny)
Parent
Re:What's the problem again? (Score:5, Insightful)
In other words: If diebold can't manage to secure their source code from theft then how the fuck can they be trusted to secure your vote from theft.
Parent
Copyright vs. election security (Score:5, Insightful)
This is assuming, of course, that there's any overall benefit to digital voting in the first place, which there really isn't. Digital elections are a terrible idea -- stick with paper. Oh no! We'll have to wait a few more hours to have complete results! Big fucking deal.
These are the disks we returned to the state (Score:5, Informative)
Security doesn't matter if the machines are rigged (Score:5, Insightful)
Who gives a fuck if J0e Hax0r can compromise a voting machine when secret code can be installed on thousands, if not all, of the voting machines at the last minute with absolutely no oversight and nobody knowing about it? Voting, to borrow from one of the current "President's" minions, is a "quaint" and outdated practice.
be cautious of a Diebold paper trail - not right! (Score:5, Insightful)
I early voted on a Diebold voter verified machine - and it's NOT good enough. I even had a nice conversation with the technical election judge, and since it did print a verified trail I did have to go home and think about this before I realized how it sucked.
They totally and complete circumvented the idea of a voter verified paper trail.
The way this machine works is you vote, it prints, you can see-but-not-touch the printout. You can vote AGAIN (up to 3 times) and it voids the previous printouts. Again, without you touching them. Which means the process expects that some percentage of its paper trail will be voided. The printouts get sent into some magic compartment.
So 1) there's no way except by noise for the election monitors to know if it printed a variety of extra votes. And they were pretty quiet.
2) There's absolutely zero way to know if it went back and voided your vote, because there's plenty of precedent for voiding votes.
3) It can absolutely tell via paper alone who voted in which order; it's on a spool. Which could be easily tracked by anyone who watched what order people voted at that machine. Your votes are even less anonymous.
*sigh*
(Ok, so I posted this on the previous Diebold story - sue me. It's important, so I reposted it, Karma be damned.)
Not 1337 h4x0rs! (Score:5, Insightful)
Re:So why did we move to electronic voting again? (Score:5, Insightful)
and the voter gets a carbon copy of the paper
You had me up until that part. The voter should be able to SEE the paper copy and verify it is accurate without being able to touch it. It is then whisked away, dropped down, or whatever onto a roll, stack or whatever so poll workers have a way to verify the machine counts with paper counts. If they are given receipts, this would provide proof they voted a certain way. Voters should not be given a copy since this opens the door to people being paid or intimidated to vote a certain way. Other than that point, I agree with your post.
Parent
Re:So why did we move to electronic voting again? (Score:5, Insightful)
Later:
"I lost the receipt."
"Our company no longer requires your services, we, uh, have decided to consolidate our action points to improve the synergy blah blah blah."
Parent
Re:New tag (Score:5, Funny)
Parent
Re:New tag (Score:5, Insightful)
Parent
Re:New tag (Score:5, Interesting)
Instead, the editors who post the story should be tagging it appropriately. As well as that, there should be a common set of tags that can be voted on for each story ( dupe, inaccurate, comfirmed, ect.. ), with the voting be weighed by user.
And even that is subject to errors, but it'd be more accurate.
Parent
Re:New tag (Score:5, Insightful)
Oh, and I wasted my mod points so I could tell you how people with senses of humour work.
Parent
Proper tags (Score:5, Funny)
Proper tags for this article may include "Diebold" "voting machines" "Maryland"
Surely you can think of some more useful tags like "electoral fraud", "corruption," "cronyism" ...
Parent